CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Description
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-80 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-v75v-6fpf-gvw8 | CVE-2026-104252 | CRITICAL |
Vitess vttablet /twopcz reflected XSS |
2026-10-15 | |
| GHSA-9437-39hj-3c93 | CVE-2026-32773 | MODERATE |
Apache Spark History Server allows stored cross-site scripting through unescaped application names |
2026-10-05 | |
| GHSA-gfhx-hw2g-v5hg | CVE-2026-97711 | LOW |
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies |
2026-09-30 | |
| GHSA-jh5r-qr3c-85q8 | CVE-2026-102279 | LOW | - |
Laravel: XSS in Debug Page Information |
2026-09-29 |
| GHSA-v65j-hff3-753c | CVE-2026-57440 | HIGH | - |
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled |
2026-09-25 |
| GHSA-wx4m-69m9-gx3m | CVE-2026-91130 | CRITICAL |
Home Assistant: XSS in Statistics Graph Card |
2026-09-22 | |
| GHSA-v73p-f52r-fmmr | CVE-2025-62198 | MODERATE |
Apache Atlas UI: Authenticated User XSS |
2026-09-11 | |
| GHSA-f2xf-7x3g-4272 | CVE-2026-55696 | MODERATE | - |
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction |
2026-08-28 |
| GHSA-p6qx-ghxm-389h | CVE-2026-35163 | MODERATE |
OctoPrint has XSS in its Suppressed Command Notifications |
2026-08-21 | |
| GHSA-8hv8-536x-4wqp | CVE-2026-50146 | HIGH |
Astro: Reflected XSS via unescaped slot name |
2026-08-12 | |
| GHSA-45qg-252v-3f7p | CVE-2026-65841 | MODERATE |
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization |
2026-07-31 | |
| GHSA-6qwm-5fm9-cvjx | CVE-2026-34033 | MODERATE |
Apache Answer vulnerable to Cross-site Scripting |
2026-07-31 | |
| GHSA-3w28-36p9-w929 | CVE-2026-52816 | MODERATE |
Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS |
2026-07-21 | |
| GHSA-pgww-w46g-26qg | CVE-2026-54570 | MODERATE |
AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass |
2026-07-17 | |
| GHSA-8rqh-vxpr-x77p | - | MODERATE |
plone.restapi: Stored XSS by spoofing mime type |
2026-07-17 | |
| GHSA-4r4f-gg25-rmg5 | CVE-2026-54503 | MODERATE |
plone.app.textfield: Stored XSS by spoofing mime type |
2026-07-17 | |
| GHSA-r5xw-gcgw-hwp5 | CVE-2026-52774 | MODERATE | - |
YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes |
2026-07-09 |
| GHSA-35f3-pg38-486f | CVE-2026-52773 | MODERATE | - |
YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` |
2026-07-09 |
| GHSA-cv6r-h2fm-pvrp | CVE-2022-35278 | MODERATE |
HTML Injection in ActiveMQ Artemis Web Console |
2026-07-08 | |
| GHSA-4h7g-5542-v3fc | CVE-2026-52854 | HIGH | - |
mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function |
2026-07-02 |
| GHSA-6vxv-wg6j-5qwp | - | HIGH |
Gogs: XSS in .ipynb files renderer due to outdated notebookjs |
2026-06-19 | |
| GHSA-5c7p-g73q-rpg5 | CVE-2026-55692 | HIGH | - |
StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled |
2026-06-19 |
| GHSA-7h5p-637f-jfr7 | CVE-2026-55691 | HIGH | - |
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template |
2026-06-19 |
| GHSA-c29q-5xm7-5p62 | CVE-2026-55690 | HIGH | - |
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text |
2026-06-19 |
| GHSA-32q2-hhr5-6qvv | CVE-2026-46492 | HIGH |
md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed) |
2026-06-09 |